Archive
June 2020
Vulnerabilities first published in this month (UTC), newest first.
1,813 results · Feed
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.
-
Critical 9.8CVE-2020-11910 EPSS 11%
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
-
Critical 9.1
The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.
-
Unscored —
The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Wr…
-
Unscored —
The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.
-
Unscored —CVE-2020-11901 EPSS 22%
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.
-
Unscored —CVE-2020-11900 EPSS 13%
The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.
-
Medium 5.4
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
KEV Mar 3, 2022 -
Unscored —
The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might al…
-
Unscored —
The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.
-
Unscored —
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.
-
Unscored —
Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization deci…
-
Unscored —
In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal dat…
-
High 7.3
Cross-site Scripting in Sanitize
In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math…
-
Low 3.7
Path Traversal in Helm Plugin Archive
In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a…
-
Unscored —
FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native…
-
Medium 6.3
Stored XSS through template injection in Wiki.js
In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a…
-
Unscored —CVE-2020-14210 Public exploit
Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to…
-
Medium 5.3
A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earl…
-
Unscored —CVE-2020-9289 Public exploit
Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, Fo…
-
Unscored —
A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and …
-
Unscored —
A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 …
-
Unscored —
A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.…
-
Unscored —
A CWE-200: Information Exposure vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could all…
-
Unscored —
A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older…
-
Unscored —
A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware vers…
-
Unscored —
A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) wh…
-
Unscored —
A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an a…
-
Unscored —
A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and old…
-
Unscored —
A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could…
-
Unscored —
A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) wh…
-
Unscored —
A CWE-787: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (Firmware version 4.3 and prior), …